Hi experts, im trying to definde a variable in my search to use is in other search. it should work as a filter in the other search.
"companyNames" is a sourcetype where several company names,Keys are stored for example Key 100001 is customer1.
on the other hand i have the sourcetype "groups" which contains groups for all the companies.
what im trying to do is to filter my second seach by searching the key 100001 so i can define a variable which will be the index for the other search, the indexes for groups are "key-cc" so this is why i define the variable id1 as "Key-cc" but the second search is empty.
search takes the terms given as literal and hence even though you assign some value to the variables. In the above example, your final search will still be index=id1 and not the value. You may verify that from job inspector.
To make the above search work, you can use where which work as conditional expressions
| eval id1= Key."-cc"
| where sourcetype=groups AND index=id1
| table groupId,groupName
However, looking at your original requirement, you may try
sourcetype=groups [ sourcetype=companyNames |"search for all keys"|eval id1= Key."-cc"|rename id1 as index ]
Final search will be formulated as sourcetype=groups (index=100001 OR index=100002)